mobile-deployment-eas
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill emphasizes security best practices for secret management. It correctly distinguishes between public environment variables (embedded in JS bundles) and EAS Secrets (build-time only), and explicitly warns against committing API keys or tokens to version control (e.g., in
eas.jsonorapp.config.ts). - [SAFE]: Guidance on handling sensitive files like Google Service Account keys and Apple Distribution certificates includes advice on using
.gitignoreand retrieving files from secure secret storage during CI/CD processes. - [SAFE]: The skill uses standard Expo CLI commands and well-known GitHub Actions (
expo/expo-github-action) for automation, adhering to established mobile development patterns without introducing external or untrusted dependencies. - [SAFE]: OTA (Over-The-Air) update patterns include safety mechanisms like 'fingerprint' runtime versioning to prevent incompatible code from crashing the application, showing a focus on operational stability.
Audit Metadata